Cisco IronPort Mail Gateway
What is Discovered and Monitored
|SNMP||Ping Status, SNMP Ping Stat, Uptime, CPU Util, Mem Util, Net Intf Stat, Hardware Status|
Mail attributes: attributes include MID, ICID, DCID, Sender address, Receiver Address, Mail Subject, Sent Bytes, Attachment, Spam indicator, Virus indicator, Quarantine indicator, SMTP delivery failures and failure codes, mail action - pass, block, clean.
Security Monitoring and compliance
In ADMIN > Device Support > Event, search for "ironport-mail" in the Display Name column to see the event types associated with this device.
There are no predefined rules for this device.
In RESOURCE > Reports, search for "ironport mail" in the Name and Description columns to see the reports for this device.
FortiSIEM uses SNMP to discover and monitor this device. Make sure SNMP is enabled for the device as directed in its product documentation. For more information, refer to sections "Discovery Settings" and "Setting Credentials" in the User Guide.
- Log in to your Ironport Mail Gateway device manager with administrator privileges.
- Edit the Log Subscription settings.
- For Log Name, enter IronPort-Mail.
This identifies the log to FortiSIEM as originating from an Ironport mail gateway device.
- For Retrieval Method, select Syslog Push.
- For Hostname, enter the IP address of your FortiSIEM virtual appliance.
- For Protocol, select UDP.
Sample Parsed Ironport Mail Gateway Syslog
Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: MID 200257071 ready 24663 bytes from <firstname.lastname@example.org>Sep 24 11:39:49 184.108.40.206 IronPort-Mail: Info: MID 1347076 ICID 346818 From: <email@example.com>Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: Message aborted MID 200257071 Dropped by antivirus Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: Delayed: DCID 5 MID 200257071 to RID 0 - 4.1.0 - Unknown address error ('466', ['Mailbox temporarily full.'])
Settings for Access Credentials
Set these Access Method Definition values to allow FortiSIEM to communicate with your device.
|Device Type||Cisco IronPort AsyncOS Mail|
|Access Protocol||See Access Credentials|
|Port||See Access Credentials|
|Password config||See Password Configuration|